A transit mobile app adds in-app payments, but the team never revisits the threat model created for the earlier schedule-only release. What is required?
Select an answer to reveal the explanation.
Short Explanation
Payments change the game: money, cards, and greedier attackers walk in. An old schedule-only threat model is a museum piece once you take dollars. Refresh the model when the architecture grows new crown jewels.
Full Explanation
Threat models are living artifacts that must be maintained as systems evolve. Adding payment processing introduces new data, trust boundaries, third parties, and attacker motivations. Revisiting and updating the model ensures mitigations track current design rather than an obsolete baseline.